Serverless API on GCP Cloud Run

Overview

This architecture runs a containerized API on Google Cloud Run, combining serverless economics with standard container portability. Use it when you want scale-to-zero and per-request billing but still want to package your service as an OCI image you can run anywhere. It suits APIs, webhook processors, and web backends with variable traffic.

Because Cloud Run takes any container that listens on a port, teams keep their existing Dockerfiles and frameworks while gaining managed autoscaling.

Components

• Cloud Run: Fully managed compute that runs OCI containers and scales instances per concurrent request, including to zero.
• API Gateway: Validates requests against an OpenAPI spec, applies auth, and routes to Cloud Run services.
• Cloud SQL: Managed PostgreSQL for relational data, reached over a private connection.
• Pub/Sub: Asynchronous messaging for decoupling and fan-out, delivering CloudEvents to subscriber services.
• Secret Manager: Stores credentials and API keys, injected at runtime.
• Cloud Monitoring and Trace: Metrics, dashboards, and distributed tracing.

Data Flow

Clients hit API Gateway, which authenticates and forwards to a Cloud Run service. The service reads and writes Cloud SQL through the Cloud SQL connector over a private VPC path. For asynchronous work, the service publishes to Pub/Sub; a separate Cloud Run service is invoked by a push subscription to process each message. Services load secrets from Secret Manager using their service-account identity. Traces flow to Cloud Trace for end-to-end latency analysis.

Scaling and Resilience

Cloud Run scales horizontally on concurrent requests, with configurable concurrency per instance and minimum instances to mitigate cold starts. Pub/Sub buffers bursts and retries failed deliveries, with dead-letter topics for poison messages. Cloud SQL offers high-availability configurations with automatic failover and read replicas for scaling reads. Deploy services across regions behind a global external load balancer for regional resilience, and use gradual traffic splitting for safe rollouts.

Security

Each service runs as a dedicated service account with least-privilege IAM. Ingress can be restricted to internal or load-balancer-only, and Cloud SQL is reached privately rather than over the public internet. API Gateway validates OAuth tokens and enforces quotas. Secret Manager centralizes credentials, and VPC Service Controls can wrap data services to prevent exfiltration. Container images are scanned and stored in Artifact Registry with signing.

Trade-offs and Alternatives

Cloud Run's container model avoids the proprietary-runtime lock-in of pure function platforms while keeping serverless billing, but request-scoped instances mean background work needs Pub/Sub or Cloud Tasks, and long-lived connections need care. At sustained high load, GKE Autopilot can be more cost-effective and offers richer networking. For purely event-driven glue, Cloud Functions is lighter. Choose Cloud Run when you value container portability, scale-to-zero, and minimal operations together.